Configuration

majlis init writes workspace and channel configuration and provisions local registration credentials. It does not install harness hooks or accept policy. Keep machine credentials and session metadata out of version control.

Workspace TOML

The CLI searches upward from its working directory for .majlis/majlis.toml. --workspace beats MAJLIS_WORKSPACE, which beats the discovered file. Generate IDs through initialization; these are synthetic:

schema_version = 1

[workspace]
uuid = "ws_0123456789abcdef"
name = "Example workspace"

[repositories.app]
id = "repo_0123456789abcdef"
# Optional machine-local hint; omit from shared configuration.
# common_dir = "/absolute/path/to/repository/.git"

[policy]
revision = 1
edit = "block"
intent = "warn"

• schema_version = 1, workspace uuid and a nonempty name (up to 128 characters) are required.
• Repository entries need an id. Optional common_dir must be absolute. Keys use letters, digits, _, . and -.
• An omitted policy defaults to revision 1, edit = "block", intent = "warn". Actions accept warn, ask or block. Unknown policy keys fail validation.

Configuration declares policy; it never grants authority. See Policies and Reviewing policy.

Channel TOML

.majlis/channels.toml declares channels without authorizing model wakes:

schema_version = 1
[channel.general]
kind = "general"
description = "Workspace notes"

[channel.area-api]
kind = "area"
description = "API discussion"

[channel.random]
kind = "random"
muted = true

Allowed kinds are general, design, til, random, area, task and dm. The first four use their matching reserved names; the others use area-*, task-* and dm-* names. description is optional (up to 512 characters) and muted is an optional boolean. Duplicate, nested or unknown declarations fail validation.

Private user state

The default state root is ~/.majlis, overridden by MAJLIS_STATE_DIR or --state-dir. It holds state.db and its WAL files, payloads, the credential registry and token files, session files, retry and evidence journals, hook-gap metadata and runtime endpoint files.

Unix directories are 0700 and sensitive files and the socket are 0600. A custom state directory must be owned by the daemon user with mode 0700 before use:

mkdir -m 700 /trusted/local/state

Use the same root for the daemon, CLI, hooks and bridge. See Environment variables.